I use my system resolvers on all my hosts, hand the IP to my unbound DNS server out and recurse over DoHs, that way everything is doing DoHs even if the underly

I use my system resolvers on all my hosts, hand the IP to my unbound DNS server out and recurse over DoHs, that way everything is doing DoHs even if the underlying software doesn't implement it. DNSCrypt can do both it's protocol and DoHs. https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN...